Darren New <dne### [at] sanrrcom> wrote:
> Plus, the directory gets mounted when 
> you log in and dismounted when you log out

  I think at least some unix networked file systems support something
similar to this. Typically if you list the contents of /home you will only
see your own home directory and nobody else's. If you explicitly 'cd' to
someone else's home directory (if it's allowed) it will appear under /home.

> And, for example, Windows allows 
> some home directories to be mounted locally, others to be mounted 
> remotely on a variety of file servers, and there has to be some 
> mechanism to tell the "client" machine which is where.

  I don't know enough about file systems to be sure, but I would be
surprised if this wasn't supported by any unix networked file system.

-- 
                                                          - Warp

Post a reply to this message

>>> Also, the new AV software we're rolling out is configured to look for 
>>> updates once per hour. Seriously. Once per hour. I don't know about 
>>> Trend, but Symantec only release updates weekly. Daily if there's a 
>>> serious outbreak. Hourly update checks?? Are you mental?!
>>
>> Except you may not know when it gets released. A new virus is found, the 
>> AV boys crank out an update at 13:00; but you don't get it until 23:00 
>> 'cos that's when you've set your system to check for updates. You're 
>> vulnerable for 4 hours
>
> Ooo, 4 hours. Big deal...
>
> [I would think it takes a tad more than 4 hours for the AV company to even 
> notice there's a new virus spreading, much less perform an extensive 
> analysis and write a fix.

A virus can do a lot of damage to a company in 4 hours... (isn't 23-13 10 
hours anyway? - oh maybe you shut your machines down at 17:00, but then how 
will they update at 23:00??)

> And let us not forget, having the AV signatures is a *cure*, not a 
> prevention.]

If you have on-access scanning enabled, then it prevents you running any 
virus code that it knows about...

Post a reply to this message

scott wrote:
>>>> Also, the new AV software we're rolling out is configured to look 
>>>> for updates once per hour. Seriously. Once per hour. I don't know 
>>>> about Trend, but Symantec only release updates weekly. Daily if 
>>>> there's a serious outbreak. Hourly update checks?? Are you mental?!
>>>
>>> Except you may not know when it gets released. A new virus is found, 
>>> the AV boys crank out an update at 13:00; but you don't get it until 
>>> 23:00 'cos that's when you've set your system to check for updates. 
>>> You're vulnerable for 4 hours
>>
>> Ooo, 4 hours. Big deal...
>>
>> [I would think it takes a tad more than 4 hours for the AV company to 
>> even notice there's a new virus spreading, much less perform an 
>> extensive analysis and write a fix.
> 
> A virus can do a lot of damage to a company in 4 hours...

Yes. But if the updates only appear once every 24 hours, doing zillions 
of update checks per day is really quite futile.

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

And lo on Tue, 08 Jan 2008 10:27:51 -0000, Invisible <voi### [at] devnull> did  
spake, saying:

> scott wrote:
>>>>> Also, the new AV software we're rolling out is configured to look  
>>>>> for updates once per hour. Seriously. Once per hour. I don't know  
>>>>> about Trend, but Symantec only release updates weekly. Daily if  
>>>>> there's a serious outbreak. Hourly update checks?? Are you mental?!
>>>>
>>>> Except you may not know when it gets released. A new virus is found,  
>>>> the AV boys crank out an update at 13:00; but you don't get it until  
>>>> 23:00 'cos that's when you've set your system to check for updates.  
>>>> You're vulnerable for 4 hours
>>>
>>> Ooo, 4 hours. Big deal...
>>>
>>> [I would think it takes a tad more than 4 hours for the AV company to  
>>> even notice there's a new virus spreading, much less perform an  
>>> extensive analysis and write a fix.
>>  A virus can do a lot of damage to a company in 4 hours...
>
> Yes. But if the updates only appear once every 24 hours, doing zillions  
> of update checks per day is really quite futile.

"Except you may not know when it gets released."

-- 
Phil Cook

--
I once tried to be apathetic, but I just couldn't be bothered
http://flipc.blogspot.com

Post a reply to this message

"Invisible" <voi### [at] devnull> wrote in message
news:47835028$1@news.povray.org...

> Yes. But if the updates only appear once every 24 hours, doing zillions
> of update checks per day is really quite futile.

Unless your update runs at 6am and a new version is added an hour later

Post a reply to this message

"scott" <sco### [at] laptopcom> wrote in message news:4783300a@news.povray.org...

> A virus can do a lot of damage to a company in 4 hours...

Especially if it gets on to your DC.

Post a reply to this message

Gail Shaw wrote:
> "Invisible" <voi### [at] devnull> wrote in message
> news:47835028$1@news.povray.org...
> 
>> Yes. But if the updates only appear once every 24 hours, doing zillions
>> of update checks per day is really quite futile.
> 
> Unless your update runs at 6am and a new version is added an hour later

The cycle goes like this:

1. Destructive virus is released.

2. It takes 72 hours for any AV companies to even notice it exists, much 
less obtain a useable sample for analysis.

3. It takes another 72 hours to analyse the virus and develop a virus 
definition for it.

4. The new definition is deployed.

5. Our server downloads and applies the definition.

My point is, that's 144 hours between the virus being released and the 
virus definition being released. An extra 24 hours before the server 
picks up the new definition seems quite trivial by conparison. The virus 
has already had plenty of time to wreck your entire network, long before 
the AV vendor has anything to offer you...

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

"Invisible" <voi### [at] devnull> wrote in message
news:4783995b$1@news.povray.org...

> My point is, that's 144 hours between the virus being released and the
> virus definition being released. An extra 24 hours before the server
> picks up the new definition seems quite trivial by conparison. The virus
> has already had plenty of time to wreck your entire network, long before
> the AV vendor has anything to offer you...

Considering how nasty some viruses can be these days, why take the risk? 24
hours could be the difference between one machine has it and the entire
network has it. And you're not necessarily going to get infected the instant
the virus comes out.

Update checks are very quick. Why not do one an hour?

Post a reply to this message

>> My point is, that's 144 hours between the virus being released and the
>> virus definition being released. An extra 24 hours before the server
>> picks up the new definition seems quite trivial by conparison. The virus
>> has already had plenty of time to wreck your entire network, long before
>> the AV vendor has anything to offer you...
> 
> Considering how nasty some viruses can be these days, why take the risk? 24
> hours could be the difference between one machine has it and the entire
> network has it. And you're not necessarily going to get infected the instant
> the virus comes out.
> 
> Update checks are very quick. Why not do one an hour?

Well, hey, why not do one an minute? Or even better, once per second?

[Ooo... the thought of 50 machines all trying to hit the same server onc 
per second over a 2 MB Internet link... that's not even funny.]

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message

"Invisible" <voi### [at] devnull> wrote in message
news:47839baf$1@news.povray.org...

> Well, hey, why not do one an minute? Or even better, once per second?

There is a point where it becomes stupid

> [Ooo... the thought of 50 machines all trying to hit the same server onc
> per second over a 2 MB Internet link... that's not even funny.]

Or one machine (server-type machine) hits the internet site and download the
definition. All the other machines retrieve the definition from the local
source.

Do all your machines get patches straight from the internet as well?

Post a reply to this message